Dubai Regulator Investigates Unlicensed Crypto Exchange
An unlicensed cryptocurrency exchange based in Dubai processed at least $4 billion while connecting Iranian gambling businesses, the country’s central bank and entities linked to the Islamic Revolutionary Guard Corps to international crypto markets.
Shelbit appears to have begun operating in May 2024 under the control of Iranian expatriate Siavash Kayvanpour. Blockchain data reviewed as part of an international investigation showed that the exchange became a central settlement point for a network involving gambling proceeds, state-linked funds, bitcoin mining revenue and transfers to major global trading platforms.
Among Shelbit’s largest customers was a network of more than 2,000 Farsi-language gambling websites promoted by Iranian influencers Sasha Sobhani and Pooyan Mokhtari.
Gambling is illegal in Iran, but the websites were able to access the country’s tightly controlled domestic payments infrastructure. Investigators traced tens of millions of dollars associated with the sites to wallets linked to Shelbit, including at least $130 million connected to one gambling platform.
Sobhani and Mokhtari denied knowing Kayvanpour or Shelbit and said they were unaware of any Iranian state involvement in the gambling businesses they promoted. Both men also denied involvement in sanctions evasion, terrorism financing or money laundering.
The investigation did not independently establish that the IRGC directly controlled Shelbit or the wider gambling network. It also could not determine which officials within the Iranian state may have overseen the operation or where much of the cryptocurrency ultimately ended up.
The blockchain evidence nevertheless showed direct financial connections between Shelbit and several parts of Iran’s state-linked crypto infrastructure.
Shelbit processed at least $125 million originating from Iran’s central bank, much of it through direct transfers. Another $20 million came from what researchers identified as a suspected Iranian bitcoin mining operation, with intermediary wallets used to obscure the original source.
The exchange also interacted with wallets that Israeli authorities have connected to the IRGC and with Nobitex, Iran’s largest cryptocurrency exchange.
The U.S. government sanctioned Nobitex in June for allegedly supporting the Iranian government, helping the central bank obtain stablecoins and facilitating transactions involving IRGC-linked actors. U.S. officials said the exchange had enabled Iranian entities to access international digital asset platforms despite financial restrictions.
Shelbit’s transactions extended well beyond Iran.
At least $676 million moved from Shelbit-linked addresses to wallets on Binance after May 2024, according to the blockchain analysis. Around $540 million of that amount was transferred after Dubai’s Virtual Assets Regulatory Authority took enforcement action against Shelbit in January 2025 for operating without a license.
Independent researcher Rich Sanders said he informed Binance about Shelbit’s suspected connections to Iran in October 2025. The blockchain data indicated that transfers continued after that warning.
Binance said Shelbit itself never held an account on the platform and disputed the claim that $540 million had been processed after the Dubai enforcement action.
The exchange said transactions associated with Shelbit had not initially been classified as high risk by an external blockchain analytics provider. It added that accounts belonging to users connected to Shelbit were later investigated, frozen and reported to law enforcement.
Binance did not identify the analytics provider or disclose how many accounts were affected.
The company previously pleaded guilty in the United States in 2023 to violations involving anti-money-laundering controls and sanctions compliance. It agreed to pay approximately $4.3 billion after U.S. authorities said it had processed hundreds of millions of dollars in transactions involving Iranian users.
Binance has since expanded its compliance operations and obtained regulatory approvals covering parts of its business in the United Arab Emirates.
Dubai regulators are now examining whether Shelbit was involved in money laundering and Iranian sanctions evasion.
VARA initially issued a cease-and-desist order against the exchange on Jan. 2, 2025, over unlicensed virtual asset services and advertising. The regulator later imposed fines and issued a further public notice on July 24 ordering Shelbit to immediately halt all unauthorized activity.
VARA said the concerns extended beyond consumer protection to cross-border transactions capable of threatening the integrity of the UAE financial system.
The U.S. Treasury Department’s Office of Foreign Assets Control is also aware of the allegations and said it was taking them seriously.
Shelbit has little visible public presence despite the billions of dollars attributed to its wallets. Its website is no longer operational, and members of the public do not appear to have any identifiable way to open an account or use the service.
Its listed Dubai address led to an office shared with a watch-trading business also associated with Kayvanpour. People found at the location reportedly denied knowledge of Shelbit and said the watches displayed there were not for sale.
Kayvanpour and the Iranian government did not respond to requests for comment.
The findings illustrate how a small, largely invisible exchange can become an important bridge between sanctioned financial networks and the global cryptocurrency market without developing a conventional customer-facing platform.
The Warning Failed to Stop the Money
The most troubling figure in the Shelbit investigation is not the total $4 billion. It is the $540 million that allegedly reached Binance-linked wallets after Dubai regulators had already taken action against the exchange.
A regulatory warning is supposed to change behavior. It should cause banks, exchanges, compliance providers and counterparties to reconsider whether continued interaction with the named business creates an unacceptable risk.
In this case, the warning did not appear to stop the flow of money.
That does not automatically establish misconduct by Binance. A blockchain transfer to a Binance wallet does not prove that Shelbit owned the receiving account, and the exchange says Shelbit never had an account in its own name.
The more difficult problem is that illicit financial networks rarely operate through accounts carrying their real identities.
They use customers, brokers, money mules, front companies and intermediary wallets. A compliance system that looks only for the exact name “Shelbit” may miss the network while technically confirming that the sanctioned or warned-about company is not a direct customer.
That is why blockchain analytics are valuable but insufficient.
The technology can trace assets between addresses, identify clusters and reveal repeated exposure to risky entities. It cannot always explain who controls an account, why funds were transferred or whether a recipient understood the source of the money.
The Shelbit case also shows how sanctions evasion can be built from businesses that appear unrelated.
Online gambling generated a stream of funds inside Iran. Influencers supplied customers and legitimacy. The domestic banking system collected local payments. Crypto mining created new digital assets. A Dubai exchange moved value outside the country, while large international platforms provided access to deeper markets and liquidity.
No single transaction necessarily exposed the entire structure. The network became visible only when investigators connected the components.
Dubai now faces a reputational test. The city has worked to become a global digital asset center by creating a dedicated regulator and licensing major exchanges. That strategy depends on showing that operating from Dubai without authorization carries consequences beyond a fine and a public notice.
An exchange that allegedly continued moving hundreds of millions of dollars after enforcement action would expose the limits of a regulatory system that identifies a problem but cannot immediately disconnect the business from the wider market.
Global exchanges face a similar challenge.
Freezing accounts after investigators identify a network is necessary, but effective compliance should also ask why the activity was not detected sooner. A platform processing hundreds of millions of dollars connected to a largely invisible exchange should generate questions even before a regulator publishes a warning.
The uncertainty around the IRGC connection must remain clear. Researchers and former Iranian officials described the network as state controlled, but the available evidence did not conclusively establish direct IRGC ownership of Shelbit.
That distinction matters legally and journalistically.
It does not reduce the broader compliance concern. Shelbit directly interacted with Iran’s central bank, a U.S.-sanctioned Iranian exchange and wallets linked by Israel to the IRGC while operating without a Dubai virtual asset license.
The case is therefore less about one mysterious exchange than about the weak points between regulatory systems.
Iran’s restrictions created demand for sanctions-evasion infrastructure. Dubai provided access to an international financial center. Blockchains made transfers fast and globally accessible. Centralized exchanges offered the liquidity needed to convert and redistribute the assets.
Each part of the system could view itself as only one step removed from the underlying activity.
Shelbit’s apparent success came from operating inside those gaps. Preventing the next network will require regulators and exchanges to act on connections between entities, not simply wait until the exact company name appears on a sanctions list.